What is social engineering
So far we have learned strong encryption and solid locks, one after another. But even the thickest safe is useless if someone inside simply opens the door. Last lesson's firewall, too, only looked at the envelope and could not stop a door a person inside opened on their own. So instead of breaking the lock, attackers sometimes trick people into opening the door. An attack like this, aimed at the human mind rather than technology, is called social engineering, and in this lesson we look at how to recognize it and the habits that stop it.
The weakest link
A chain breaks at its weakest link. However many thick links it has, if one weak link gives way, the whole chain fails. Security works the same way. Even with strong encryption and solid locks, if the person handling them absent-mindedly opens the door, everything else is wasted.
So attackers sometimes skip the strongest technology and go for the weakest link: people. This does not mean people are foolish. Technology follows the same rules every time, while people get busy, get tired, and trust others. Defense begins with admitting that first.
Tap the strong lock, then tap the side where a person opens the door. The technology holds firm, but once the door opens, the lock is useless.
No matter how hard the lock was struck it held, yet the moment the person's door opened, the strong lock became completely pointless. That is exactly the spot attackers aim for. Instead of struggling to break hard technology, they look for the easier path beside it.
It sounds frightening, but there is no need to panic. Just knowing that these attacks are common, and that they arrive through channels you use every day, such as email, text messages, and phone calls, already puts you halfway to being ready. So what in people do attackers poke at?
What do they target in people
Attackers turn people's good nature against them. You do not need to memorize specific tricks; it is enough to know which feelings get targeted. Three are touched most often.
The first is urgency: they leave no time to think and push you to act right now. The second is authority: they pretend to be a boss, a public agency, or a bank so that you comply. The third is goodwill: they approach pretending to be in trouble and use your wish to help. Fear or curiosity is often stirred in as well. When you see these signals, it is a good idea to stop for a moment.
Tap the three feelings one by one to look at them. It is enough to know that feelings like urgency, authority, and goodwill get targeted.
All three are actually our good sides: wanting to handle things quickly, respecting people above us, and looking out for others. Attackers twist these good feelings the wrong way.
That does not mean you should become cold and suspicious. Keep the good feelings as they are, and just add the habit of stopping once when you are being rushed. After stopping, there is one thing to do: check whether the request is really genuine. How to do that comes next.
The habit of checking
Say a sudden request comes in. Answering right away through the very channel it came from can be risky, because the channel itself may be fake. A sender's name, a number, or the look of a screen can all be imitated.
So the secret of defense is to change the channel. If someone demands something over the phone, do not ask back on that number; call a separate official number you already know and check. Instead of tapping the link in a message, go in through the app you always use or an address you type yourself. You check the same matter once more through a different channel.
Tap the two responses to compare them. Checking separately through an official channel is safer than answering right away through the channel the request came from.
Side by side, the difference between the two paths was clear. If you answer through the channel the request came from, there is no way to stop it when that channel is fake; if you check separately through an official channel, the fake gets filtered out there. Checking may take a few more minutes, but those minutes can prevent a big accident.
Even a truly urgent matter is not harmed by checking again. If anything, being stopped from checking, being told to keep it secret, or being rushed with anger is an even more suspicious signal. Now let's gather why suspicion itself is a defense.
Suspicion is defense
The weapons against social engineering are not grand. A few small habits you have made your own are enough. First, slow down: the more you are rushed, the more you should stop once and take a breath. Second, check through another channel: ask separately through an official channel, as we just saw.
Third, do not tell secrets. Never give out a password or a code received by text, no matter who asks, because a real organization does not ask for such secrets outright. The second step we saw in the authentication lesson also loses its meaning the moment you hand that code to someone else.
Tap the three defense rules in order to pick them up: slow down, check through another channel, and do not tell secrets.
With all three rules picked up, notice that none of them is hard technology. They are just attitudes: slowing down a beat, checking once more, and keeping secrets to yourself. That is why anyone can defend against social engineering, without special equipment or knowledge.
If you feel you have already been fooled, the important thing is not to hide it out of embarrassment. Change your password right away, tell the organization through its official channel, and at work, report it to the team in charge. The sooner you report it, the smaller the damage. Suspicion is not rudeness; it is courtesy that protects you and others.
Wrapping up
Put together, it goes like this. However strong the encryption, the weakest link is people. Attackers sometimes target the human mind instead of technology, poking at feelings such as urgency, authority, and goodwill. You do not need to memorize their tricks; knowing that such attacks exist is enough.
Defense comes down to three habits: slow down, check through another channel, and do not tell secrets. If you have already been fooled, do not hide it; report it quickly. The habit of calmly doubting and checking is the strongest shield.
Tap the four key points in order to review: the weakest link is people, what they target is the mind, check through another channel, and suspicion is defense.
Now you hold the human piece of security. However solid encryption and locks are, they are only complete when the people using them stay alert. The moment you stop once in front of a strange, urgent request, you are already using the strongest security there is.
The encryption, authentication, firewalls, and human habits we have learned are not used one by one in isolation. Next lesson, we look at the principles of designing security: how to fit these pieces together into a structure that is safe.